1 Introduction

This project delves into analyzing ransomware infections using data extracted from the Shodan API. By analyzing real-time data on internet-connected devices, we explore ransomware trends across various countries and cities. Through data visualizations and statistical analysis, we aim to identify geographic hotspots of ransomware activity, comprehend infection patterns, and provide valuable insights for cybersecurity professionals. The project underscores the importance of monitoring and comprehending ransomware incidents to enhance global cyber defenses.

1.1 Shodan API Overview

The Shodan API, a powerful tool for searching and retrieving data on internet-connected devices, provides information about devices’ locations, services, vulnerabilities, and more. In this project, the API is used to analyze global trends and patterns of ransomware infections.

2 Data Analysis of Ransomware Infections

This section analyzes ransomware infections. It starts with a summary of affected countries and reported incidents. A statistical analysis presents key metrics on infection distribution. The section concludes with a table detailing ransomware incidents by country and city, revealing geographic trends and high-infection areas.

2.1 Ransomware Infections Summary

According to the Shodan dataset, a total of 120 ransomware infections have been reported worldwide, impacting 41 countries. Brazil has the highest number of ransomware infections, reporting 12 incidents.

The city with the most ransomware infections is Frankfurt am Main, with 5 incidents.

2.1.1 Statistical Analysis

  • The average number of ransomware infections per country is 2.93.
  • The median number of ransomware infections per country is 1.
  • The standard deviation of ransomware infections per country is 3.09.

2.2 Table of Ransomware Infections by Country and City

This comprehensive table offers a detailed breakdown of ransomware infection rates across various countries and cities. It presents country and city names alongside the corresponding number of ransomware incidents, making it easy to compare regions. This table serves as a crucial reference point for understanding global ransomware trends and identifying areas where cyber defenses may need reinforcement.

Distribution of Ransomware Infections by Country and City
Country City Number of Infections
1082 Germany Frankfurt am Main 5
2245 Russian Federation Moscow 4
1554 Turkey Istanbul 3
2717 Czechia Prague 3
3098 Mexico Santiago de Querétaro 3
3121 Brazil São Paulo 3
3166 China Shanghai 3
322 Spain Barcelona 2
529 Turkey Bursa 2
959 Germany Düsseldorf 2
1392 United States Herndon 2
1760 Ukraine Kyiv 2
2055 Brazil Manaus 2
2394 Germany Nürnberg 2
3042 Chile Santiago 2
3207 China Shenzhen 2
3443 Uzbekistan Tashkent 2
3590 Mexico Villahermosa 2
17 Ghana Accra 1
61 Kazakhstan Almaty 1
121 United States Altamonte Springs 1
128 Brazil Aracruz 1
169 Brazil Araranguá 1
244 United States Ashburn 1
266 Kazakhstan Astana 1
337 China Beijing 1
374 Brazil Boa Esperança 1
425 France Bourg-en-Bresse 1
455 Belarus Brest 1
546 Egypt Cairo 1
581 Canada Calgary 1
654 United States Cedar Grove 1
665 China Chengdu 1
721 Moldova, Republic of Chisinau 1
747 China Chongqing 1
780 Argentina Comodoro Rivadavia 1
830 Colombia Cúcuta 1
900 United States Des Moines 1
905 Bangladesh Dhaka 1
1000 Germany Falkenstein 1
1034 China Foshan 1
1108 Argentina Godoy Cruz 1
1153 Brazil Goiânia 1
1207 India Gurugram 1
1231 Argentina Haedo 1
1312 Viet Nam Hanoi 1
1326 Finland Helsinki 1
1435 Viet Nam Ho Chi Minh City 1
1453 India Hyderābād 1
1502 Pakistan Islamabad 1
1563 Brazil Itajaí 1
1633 South Africa Johannesburg 1
1676 Taiwan Kaohsiung 1
1699 India Kolkata 1
1788 Nigeria Lagos 1
1843 United States Lee’s Summit 1
1873 Peru Lima 1
1916 Portugal Lisbon 1
1962 Spain Madrid 1
2005 Turkey Maltepe 1
2011 Bahrain Manama 1
2101 Colombia Manizales 1
2142 Colombia Medellín 1
2212 United States Mercerville 1
2273 India Mumbai 1
2327 Russian Federation Novyy Urengoy 1
2360 Mexico Nuevo Laredo 1
2442 Mexico Ojuelos de Jalisco 1
2479 Japan Osaka 1
2512 Czechia Ostrava 1
2554 Denmark Otterup 1
2610 Panama Panamá 1
2651 Panama Panama City 1
2688 Mexico Piedras Negras 1
2770 Mexico Puebla 1
2817 Poland Radom 1
2868 United States Rancho Santa Margarita 1
2896 Pakistan Rawalpindi 1
2916 Brazil Rio de Janeiro 1
2983 Russian Federation Saint Petersburg 1
3032 United States Santa Fe Springs 1
3272 Singapore Singapore 1
3302 Macedonia, Republic of Skopje 1
3327 Bulgaria Sofia 1
3401 United States Tacoma 1
3449 Brazil Toledo 1
3520 Spain Tortosa 1
3527 Argentina Villa Sarmiento 1
3643 Spain Villanueva de la Cañada 1
3670 Lithuania Vilnius 1
3723 Singapore Woodlands 1
3763 Serbia Zrenjanin 1

3 Data Visualization of Ransomware Infections

This section visualizes ransomware infection patterns globally. It maps incidents at country and city levels using Shodan API data, highlighting affected regions and trends. An interactive map lets users zoom in and examine infection details, making it useful for cybersecurity professionals and researchers.

3.1 Exploring Ransomware Hotspots

This data visualization explores the global distribution of ransomware infections, focusing on the geographical hotspots by country and city. Using data from the Shodan API, the map highlights areas with the highest concentrations of ransomware incidents, shedding light on trends and patterns in cyberattacks. By mapping ransomware infections based on real-time data, the visualization provides insights into which regions are most affected and allows for a better understanding of the geographic spread of these cyber threats. The interactive map enables users to zoom in on specific locations and view detailed information on the number of incidents, cities, and countries impacted, offering valuable insights for cybersecurity professionals and researchers.